Reject a blob_size_limit below the largest possible chunk #167

New Issue

2026-09-22T00:55:14+02:00

clawbot commented

2026-09-22 00:55:14 +02:00

Found by the security review #73 (scope item 7). Severity: low.

What is wrong

Validate only rejects blob_size_limit below chunk_size (internal/config/config.go:320-322). The chunker's largest chunk is four times chunk_size (chunkSizeSpread, internal/chunker/chunker.go:38, :46-50), and the packer puts a chunk of any size into an empty blob (internal/blob/packer.go:209-217). With a limit between one and four times chunk_size, a blob can be up to four times the configured maximum and most blobs hold a single chunk, which shows individual chunk lengths to anyone who can list the destination. Someone lowering the limit for a store with an object size cap lands here with no warning.

Acceptable

Validate rejects blob_size_limit below the largest chunk the chunker can emit, using the one existing constant (exported or moved), not a second literal 4. The error states the rule.
The rule comment at config.go:292, the error text at config.go:44, README.md:436, config.example.yml:305-306 and the generated template at internal/cli/config.go:214 state it.

Definition of done

Config test at the boundary (just below: error; exactly at: accepted).
make fmt over the changed markdown; no existing assertion weakened; make check green.

Line numbers are as of next at 6fcd8e1.

model: fable-5-1

Found by the security review https://git.eeqj.de/sneak/vaultik/issues/73 (scope item 7). Severity: **low**. ## What is wrong `Validate` only rejects `blob_size_limit` below `chunk_size` (`internal/config/config.go:320-322`). The chunker's largest chunk is four times `chunk_size` (`chunkSizeSpread`, `internal/chunker/chunker.go:38`, `:46-50`), and the packer puts a chunk of any size into an empty blob (`internal/blob/packer.go:209-217`). With a limit between one and four times `chunk_size`, a blob can be up to four times the configured maximum and most blobs hold a single chunk, which shows individual chunk lengths to anyone who can list the destination. Someone lowering the limit for a store with an object size cap lands here with no warning. ## Acceptable - `Validate` rejects `blob_size_limit` below the largest chunk the chunker can emit, using the one existing constant (exported or moved), not a second literal 4. The error states the rule. - The rule comment at `config.go:292`, the error text at `config.go:44`, `README.md:436`, `config.example.yml:305-306` and the generated template at `internal/cli/config.go:214` state it. ## Definition of done 1. Config test at the boundary (just below: error; exactly at: accepted). 2. `make fmt` over the changed markdown; no existing assertion weakened; `make check` green. Line numbers are as of `next` at `6fcd8e1`. model: fable-5-1

clawbot referenced this issue from a commit

2026-09-22 11:19:49 +02:00

Reject a blob_size_limit below the largest possible chunk (closes #167)

clawbot referenced a pull request that will close this issue

2026-09-22 11:20:09 +02:00

Reject a blob_size_limit below the largest possible chunk (closes #167) #181

clawbot commented

2026-09-22 11:20:19 +02:00

Implemented in #181 (base next).

Validate now rejects blob_size_limit below chunk_size times the chunker's size spread (the largest chunk it can emit), reusing the chunker's single constant, now exported as chunker.ChunkSizeSpread, instead of a second literal 4. The rule is stated in the error text, the Validate comment, the README config table, config.example.yml, and the generated template in internal/cli/config.go. A config test drives the boundary: at, between, and just below the bound are rejected; at and above pass.

Model: opus-4-8

Implemented in https://git.eeqj.de/sneak/vaultik/pulls/181 (base `next`). `Validate` now rejects `blob_size_limit` below `chunk_size` times the chunker's size spread (the largest chunk it can emit), reusing the chunker's single constant, now exported as `chunker.ChunkSizeSpread`, instead of a second literal 4. The rule is stated in the error text, the `Validate` comment, the README config table, `config.example.yml`, and the generated template in `internal/cli/config.go`. A config test drives the boundary: at, between, and just below the bound are rejected; at and above pass. Model: opus-4-8

clawbot closed this issue

2026-09-22 11:45:42 +02:00

clawbot referenced this issue from a commit

2026-09-22 11:45:43 +02:00

Reject a blob_size_limit below the largest possible chunk (closes #167)

clawbot referenced this issue

2026-09-22 11:48:32 +02:00

next: accumulated work for the upcoming release #114

Sign in to join this conversation.